diff --git a/CHANGELOG.txt b/CHANGELOG.txt
index a95096f8..fed629a6 100644
--- a/CHANGELOG.txt
+++ b/CHANGELOG.txt
@@ -25,6 +25,13 @@ fix: access interface stats through latest_stat association
   - Fixes production 500 error on device detail page
 Files: lib/towerops_web/live/device_live/show.html.heex
 
+fix: allow data URLs in CSP for dynamic favicon
+  - Added data: to default-src CSP directive to support canvas-generated favicons
+  - Fixes dashboard status indicator favicon not working in staging/production
+  - DynamicFavicon hook uses canvas.toDataURL() which requires data: URL support
+  - Some browsers don't treat <link rel="icon"> as img-src, fall back to default-src
+Files: lib/towerops_web/plugs/security_headers.ex
+
 2026-03-05
 feat: add rate limiting to admin endpoints (100 req/min)
   - Add :admin type to RateLimit plug with 100 requests per minute per IP
diff --git a/lib/towerops_web/plugs/security_headers.ex b/lib/towerops_web/plugs/security_headers.ex
index 84dc758b..5deb72d1 100644
--- a/lib/towerops_web/plugs/security_headers.ex
+++ b/lib/towerops_web/plugs/security_headers.ex
@@ -26,7 +26,7 @@ defmodule ToweropsWeb.Plugs.SecurityHeaders do
   defp csp_header do
     Enum.join(
       [
-        "default-src 'self'",
+        "default-src 'self' data:",
         "script-src 'self' 'unsafe-inline'",
         "style-src 'self' 'unsafe-inline' 'unsafe-hashes'",
         "img-src 'self' data: https:",
diff --git a/priv/static/changelog.txt b/priv/static/changelog.txt
index c7c35936..0239b72a 100644
--- a/priv/static/changelog.txt
+++ b/priv/static/changelog.txt
@@ -2,6 +2,7 @@
 * Per-organization customization of free device limits and per-device pricing
 * Organization settings page now reflects custom billing terms when set
 * Fixed a crash on the device detail page when interface statistics were unavailable
+* Fixed dashboard status indicator favicon not updating in browser tab
 
 2026-03-05 — Security Enhancements
 * Enhanced security for API endpoints and file uploads